WZCNFLCT.EXE False Positive?

Avast Free Antivirus / Premium Security
1

Avast is detecting & REMOVING, wzcnflct.exe, which I believe is a trusted Windows file. When I restore it, Avast only again removes the file when I am in the containing folder of said file.

Any thoughts on this? Thanks!

2

I don’t have any file of this name on my HDD…
What makes you think it’s a file belonging to the OS?
What version of Windows are you running?

Thanks
Vlk

3

Found these links.

http://support.microsoft.com/kb/300269

http://technet.microsoft.com/en-us/library/cc917584.aspx

4

A legit one was shipped with a rather obsolete MS SQL Server version. Maybe also MS Jet. Anyway, all this stuff is 10+ years old. ???

5
What makes you think it's a file belonging to the OS? What version of Windows are you running?

Well, I am XP on a 6 year old pc, & like Gopher John pointed out, there is talk of this file on microsoft.com

So, I thought this to be an FP, & I need Avast to stop removing it, so it would seem.

TY

6

Unless you installed MSSQL Server 7 then the file should not be on your system at all. A Virustotal scan would help.

7

I don’t have wzcnflct.exe on this machine, with up to date WinXP Pro SP3. Machine is a circa 2005 Dell. Either something you installed placed it there, or malware is using that filename to stay below the radar. As doktornotor stated, submit the file to VirusTotal for scanning. Post the link to the results back here.

8

hello everyone,

I got same problem today !

Avast found “WZCNFLCT.EXE”

“Win32:Malware-gen” has been found in “C:\Program Files (x86)\Common Files\microsoft shared\Database Replication\WZCNFLCT.EXE” file.

“Win32:Malware-gen” has been found in “\localhost\C$@GMT-2011.02.25-16.46.09\Program Files (x86)\Common Files\microsoft shared\Database Replication\WZCNFLCT.EXE” file.

I don’t know what to do ?!

Thank you

(my OS is WIN 7 HOME)

9

No problem here.

10

“WZCNFLCT.EXE” might be infected ?? or that’s a False Positive ?

I am lost…

11

As already stated in this thread, send it to http://www.virustotal.com/ and post the results link back here in this thread.

12

hello,

here is the result:

http://www.virustotal.com/file-scan/report.html?id=bf42d743efc3603c8887eed2cb85c8ca8c567bd7dc6c0936bc0f66f1dfc74fd5-1298835254

thanks

13

Hmmm, much more clear now… ;D Not detected there by Avast at all.

People having the problem here should post exact Avast and virus database versions at least.

14

G-Data Engine B (avast!) detect It as generic type of Malware. But avast! not. ???
It should be FP.

15

??? ???

Ok, with VirusTotal.com result, only for GData that’s a Malaware.

But why my “Avast 4.8” found that file is infected by Malware ??

  • as you said maybe a False Positive…

I am going to upgrade to Avast 5, and I ll check again.

16

Same here. Running Avast 6.0.1000 on Windows 7 64bit and it just flaged

C:\Program Files (x86)\Common Files\microsoft shared\Database Replication\WZCNFLCT.EXE

as Win32:Malware-gen

Tested the files with TotalVirus and got 1/43, only GData flags it as Win32:Malware-gen

http://www.virustotal.com/file-scan/report.html?id=bf42d743efc3603c8887eed2cb85c8ca8c567bd7dc6c0936bc0f66f1dfc74fd5-1298836376

17

Virustotal seems to be using out of date definitions for avast but up to date for Gdata, which probably explains the difference

18

I am thinking to Delete WZCNFLCT.EXE…

but I can’t find if Win 7 Home really need it…

what do you think ?

19

I would be inclined to do nothing until after the next avast definition update (or two or three).

Have you reported the file as a suspect fp via the chest report function?

20

Just keep It in virus chest and after the next 1-3 VPS updates you should test It and when It will be reported as malware, delete It. When It will report that it’s clean you will can restore file

And as @mag said you should send It to a lab using virus chest…